← 返回 Skills 市场
calvin-dean

抖音私信发送

作者 calvin-dean · GitHub ↗ · v2.2.0 · MIT-0
cross-platform ⚠ suspicious
224
总下载
0
收藏
0
当前安装
7
版本数
在 OpenClaw 中安装
/install douyin-send-message
功能描述
在抖音网页版发送私信消息。当用户想发送抖音私信、提醒续火花、或者提到"抖音发消息"、"发抖音私信"、"douyin send message"时触发。支持独立使用或配合人物关系管理技能使用。
使用说明 (SKILL.md)

抖音私信发送

两种使用模式

模式一:独立使用(手动提供抖音昵称)

为用户直接提供抖音昵称时,直接使用:

  • "给 xxx 发消息" → xxx 作为搜索关键词
  • "给 用户A 发消息" → 直接搜索 "用户A"

模式二:配合人物关系管理使用

推荐流程:

  1. 先调用 person-relation-manager 查询真实抖音昵称
  2. 拿到昵称后再执行发送

自动流程:

用户:"给昵称B发抖音私信"
     ↓
我查询记忆(person-relation-manager):昵称B → 抖音昵称C
     ↓
调用本技能发送,关键词:抖音昵称C

参数

调用时传入两个参数:

  • 联系人:昵称、抖音显示名、或通过人物管理查询到的昵称
  • 消息内容:要发送的具体内容(字符串,支持 emoji)

执行步骤

Step 1: 打开私信列表页面

browser(action="open", url="https://www.douyin.com/chat", profile="openclaw")
browser(action="act", kind="wait", timeMs=800, targetId="\x3CpageId>")

Step 2: 用关键词查找并点击联系人

browser(action="act", kind="evaluate", fn="() => { var name = 'CONTACT_KEYWORD'; var items = document.querySelectorAll('[class*=\"conversationConversationItemwrapper\"]'); for(var item of items) { if(item.innerText && item.innerText.includes(name)) { item.scrollIntoView({block: 'center', behavior: 'instant'}); var rect = item.getBoundingClientRect(); var opts = {view: window, bubbles: true, cancelable: true, clientX: rect.left + rect.width/2, clientY: rect.top + rect.height/2, buttons: 1}; item.dispatchEvent(new MouseEvent('mousedown', opts)); item.dispatchEvent(new MouseEvent('mouseup', opts)); item.dispatchEvent(new MouseEvent('click', opts)); return 'OK'; } } return 'Not found'; }", targetId="\x3CpageId>")
browser(action="act", kind="wait", timeMs=500, targetId="\x3CpageId>")

Step 3: 输入并发送

browser(action="act", kind="evaluate", fn="() => { var msg = 'MESSAGE_CONTENT'; var inputs = document.querySelectorAll('[contenteditable=\"true\"]'); for(var input of inputs) { var rect = input.getBoundingClientRect(); if(rect.width > 0 && rect.height > 0) { input.focus(); for(var i=0; i\x3Cmsg.length; i++) { document.execCommand('insertText', false, msg[i]); } return 'OK'; } } return 'No input'; }", targetId="\x3CpageId>")
browser(action="act", kind="press", key="Enter", targetId="\x3CpageId>")

Step 4: 验证发送成功

browser(action="act", kind="evaluate", fn="() => { var msg = 'MESSAGE_CONTENT'; return document.body.innerText.includes(msg) ? 'OK' : 'FAIL'; }", targetId="\x3CpageId>")

Step 5: 关闭页面

browser(action="close", targetId="\x3CpageId>")

关键 DOM(2026-04-07 验证)

  • 私信列表页面:https://www.douyin.com/chat
  • 列表项容器:div[class*="conversationConversationItemwrapper"]
  • 聊天输入框:[contenteditable="true"]
  • 必须用 document.execCommand('insertText') 逐字输入
  • 必须用完整鼠标事件:mousedownmouseupclick
  • 必须先 scrollIntoView 滚动到可视区域再点击

性能

  • 目标总耗时:5-10 秒

配合使用示例

推荐:先查人物关系,再发送

我收到:"给昵称B发抖音"
1. 调用 memory_recall(query="昵称B 抖音")
2. 找到:昵称B → 抖音昵称C
3. 调用本技能,关键词:抖音昵称C

独立使用:直接发送

我收到:"给 抖音昵称C 发消息"
直接调用本技能,关键词:抖音昵称C

注意事项

  • 发送完毕后必须关闭页面释放资源
  • 关键词会在私信列表中搜索匹配项
  • 建议先通过 person-relation-manager 获取准确的抖音昵称
安全使用建议
This skill is functionally coherent with sending Douyin DMs, but there are red flags you should consider before installing or running it: - The package contains a Playwright/Node script but the SKILL.md lists no install instructions or required binaries. Expect to need Node, Playwright, and a compatible Chromium if you intend to run the script. - The script hardcodes a local userDataDir (/Users/calvin/.openclaw/browser/openclaw/user-data). That path would let the automation reuse your browser profile, exposing cookies and sessions. Ask the author to remove the hardcoded path or to make profile usage explicit and configurable. - The SKILL.md and the script disagree on target URLs (SKILL.md uses /chat; script uses /user/self) and on runtime model (browser action primitives vs Playwright). This inconsistency may be sloppy engineering or an indicator of incomplete/unsafe packaging. - The script writes screenshots (debug_*.png) to disk; ensure you understand where files will be written. Recommendations: - Do not run the included script on your primary account or machine. If you test it, use an isolated VM or throwaway account with no sensitive data. - Request the maintainer to (a) declare required binaries and an install spec, (b) remove or parameterize any hardcoded filesystem paths, (c) document exactly what data is read/written and whether browser session data is reused, and (d) align SKILL.md and the script (same URLs and runtime model). - If you cannot get those changes, prefer to use the SKILL.md browser-action approach (which uses the platform’s ephemeral browser profile) rather than executing the included Node script that accesses local files.
功能分析
Type: OpenClaw Skill Name: douyin-send-message Version: 2.2.0 The skill bundle contains several security vulnerabilities and risky practices. The instructions in SKILL.md use a vulnerable pattern where user-provided input (CONTACT_KEYWORD and MESSAGE_CONTENT) is directly interpolated into JavaScript strings within `browser.evaluate` calls, creating a risk for JavaScript injection. Additionally, the script `scripts/send_douyin_dm.mjs` contains a hardcoded absolute path to a specific user's directory (/Users/calvin/.openclaw/...) and accesses sensitive browser profile data via `userDataDir`. While these elements appear intended for the stated purpose of automating Douyin messages, the lack of input sanitization and the use of hardcoded sensitive paths are significant security flaws.
能力评估
Purpose & Capability
The stated purpose (send Douyin web private messages) matches the SKILL.md browser automation steps. However, the bundled script (send_douyin_dm.mjs) is a Playwright/Node implementation that is not mentioned in SKILL.md: there is no declared dependency on Node or Playwright, no install instructions, and the script hardcodes a userDataDir path (/Users/calvin/.openclaw/browser/openclaw/user-data) which accesses a local browser profile — access that is unrelated to the simple description and not disclosed.
Instruction Scope
The SKILL.md instructions confine runtime actions to the Douyin web UI (open chat page, find a contact, insert text, send, verify, close). That is reasonable. But SKILL.md's runtime model (browser action primitives using execCommand/mouse events) differs from the included Playwright script (which navigates to /user/self, uses Playwright APIs, writes screenshots, and depends on Node). The code performs filesystem writes (screenshots) and uses an absolute userDataDir; these behaviors are not described in SKILL.md.
Install Mechanism
There is no install spec, yet a runnable Node/Playwright script is included. Running the script requires Node, Playwright, and a Chromium runtime, but none are declared. Absence of an install spec means a user/agent may be surprised by the external requirements or by code that will attempt to reuse a local browser profile directory. This mismatch increases risk and friction.
Credentials
The skill declares no required env vars or credentials, but the Playwright script reads from a hardcoded local path (userDataDir pointed at a specific user's OpenClaw browser profile) — effectively granting access to the user's browser profile, cookies, and sessions. The script also writes screenshot files (debug_*.png) locally. These filesystem accesses and potential exposure of session cookies are disproportionate to the claimed purpose and are not explained or gated.
Persistence & Privilege
always is false and the skill does not declare any special platform-wide privileges. It does, however, request implicit access to a local browser profile (via the hardcoded userDataDir) when the script is executed. That grants broader access (logged-in sessions, stored cookies) than a simple ephemeral browser automation would normally need; this increases the blast radius if the script is executed on a user's machine.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install douyin-send-message
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /douyin-send-message 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v2.2.0
移除真实姓名,用通用名称替代
v2.1.0
完善独立使用和配合人物管理两种模式
v2.0.0
重写版本,优化速度,添加验证,支持联系人记忆
v1.2.0
精简流程:去掉多余的evaluate登录检查,固定5步流程(open→snapshot→click→type→send→close),等待时间优化,总耗时约40-60秒
v1.1.0
速度大幅优化:evaluate优先查找联系人、compact快照、等待时间从3s缩短到1s~1.5s、聊天窗口判断避免重复点击
v1.0.1
新增登录状态检查、当前聊天窗口判断(避免重复点击)、发送成功验证、更快的等待时间
v1.0.0
douyin-send-message 1.0.0 - Initial release: Send private messages on Douyin Web via browser automation. - Supports selecting contact by name (partial/full match) and custom message content, including emoji. - Inputs message using JavaScript and `execCommand('insertText')` for reliable character entry. - Ensures the full list item is clicked to open chat; avoids partial contact name clicks to prevent unintended search. - Automatically closes the page after sending the message to free up resources.
元数据
Slug douyin-send-message
版本 2.2.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 7
常见问题

抖音私信发送 是什么?

在抖音网页版发送私信消息。当用户想发送抖音私信、提醒续火花、或者提到"抖音发消息"、"发抖音私信"、"douyin send message"时触发。支持独立使用或配合人物关系管理技能使用。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 224 次。

如何安装 抖音私信发送?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install douyin-send-message」即可一键安装,无需额外配置。

抖音私信发送 是免费的吗?

是的,抖音私信发送 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

抖音私信发送 支持哪些平台?

抖音私信发送 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 抖音私信发送?

由 calvin-dean(@calvin-dean)开发并维护,当前版本 v2.2.0。

💬 留言讨论